mystic | 8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08

General

Target

8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe
Size

276KB
MD5

d7b91181dc97b2ca65b1015fbbc71af0
SHA1

6c27ff2d9d0c84f5b9168fabc0176f05d7e96bcb
SHA256

8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08
SHA512

82f89e07d41f8367bc80359e431b6052cc2b79830278e2fcd34dbd9a3683568068edb03b4da59f5e07120adca68b1e7b695c294c7347b4dec712b2e13ce0aea8
SSDEEP

6144:Wh0RKajWpVP060qLE5/JjsXOqDWmUadL6BakuUe9/b7rj:WyKajWFLE59s+k4AuakuU8j

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1304-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1304-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1304-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1304-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1304-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1304-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2692	3060	WerFault.exe	27
2944	1304	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 1304	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	29
PID 3060 wrote to memory of 2692	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	30
PID 3060 wrote to memory of 2692	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	30
PID 3060 wrote to memory of 2692	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	30
PID 3060 wrote to memory of 2692	3060	8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe	30
PID 1304 wrote to memory of 2944	1304	AppLaunch.exe	31
PID 1304 wrote to memory of 2944	1304	AppLaunch.exe	31
PID 1304 wrote to memory of 2944	1304	AppLaunch.exe	31
PID 1304 wrote to memory of 2944	1304	AppLaunch.exe	31
PID 1304 wrote to memory of 2944	1304	AppLaunch.exe	31
PID 1304 wrote to memory of 2944	1304	AppLaunch.exe	31
PID 1304 wrote to memory of 2944	1304	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe
"C:\Users\Admin\AppData\Local\Temp\8076f01afd589910a0f2c7b347fdc6633f20e4fb6e6f67c5457217d1af63ca08.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 196
    3⤵
    - Program crash
    PID:2944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 68
  2⤵
  - Program crash
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1304-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1304-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1304-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1304-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1304-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1304-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1304-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1304-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1304-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads